Куда я попал?

SECURITM это SGRC система, автоматизирующая процессы в службах информационной безопасности. SECURITM помогает построить и управлять ИСПДн, КИИ, ГИС, СМИБ/СУИБ, банковскими системами защиты.
А еще SECURITM это место для обмена опытом и наработками для служб безопасности.

Подробнее

Unsecured Credentials

Sub-techniques (7)

ID	Name
.001	Credentials In Files
.002	Credentials in Registry
.003	Bash History
.004	Private Keys
.005	Cloud Instance Metadata API
.006	Group Policy Preferences
.007	Container API

Adversaries may search compromised systems to find and obtain insecurely stored credentials. These credentials can be stored and/or misplaced in many locations on a system, including plaintext files (e.g. Bash History), operating system or application-specific repositories (e.g. Credentials in Registry), or other specialized files/artifacts (e.g. Private Keys).

ID: T1552

Sub-techniques: .001 .002 .003 .004 .005 .006 .007

Tactic(s): Credential Access

Platforms: Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows

Permissions Required: Administrator, SYSTEM, User

Data Sources: Command: Command Execution, File: File Access, Process: Process Creation, User Account: User Account Authentication, Windows Registry: Windows Registry Key Access

Version: 1.2

Created: 04 Feb 2020

Last Modified: 01 Apr 2022

Name	Description
Procedure Examples
Astaroth	Astaroth uses an external software known as NetPass to recover passwords. (Citation: Cybereason Astaroth Feb 2019)

Mitigation	Description
Mitigations
Encrypt Sensitive Information	Protect sensitive information with strong encryption.
Update Software	Perform regular software updates to mitigate exploitation risk.
User Training	Train users to be aware of access or manipulation attempts by an adversary to reduce the risk of successful spearphishing, social engineering, and other techniques that involve user interaction.
Active Directory Configuration	Configure Active Directory to prevent use of certain techniques; use SID Filtering, etc.
Password Policies	Set and enforce secure password policies for accounts.
Operating System Configuration	Make configuration changes related to the operating system or a common feature of the operating system that result in system hardening against techniques.
Filter Network Traffic	Use network appliances to filter ingress or egress traffic and perform protocol-based filtering. Configure software on endpoints to filter network traffic.
Restrict File and Directory Permissions	Restrict access by setting directory and file permissions that are not specific to users or privileged accounts.
Audit	Perform audits or scans of systems, permissions, insecure software, insecure configurations, etc. to identify potential weaknesses.
Privileged Account Management	Manage the creation, modification, use, and permissions associated to privileged accounts, including SYSTEM and root.

Detection

While detecting adversaries accessing credentials may be difficult without knowing they exist in the environment, it may be possible to detect adversary use of credentials they have obtained. Monitor the command-line arguments of executing processes for suspicious words or regular expressions that may indicate searching for a password (for example: password, pwd, login, secure, or credentials). See Valid Accounts for more information. Monitor for suspicious file access activity, specifically indications that a process is reading multiple files in a short amount of time and/or using command-line arguments indicative of searching for credential material (ex: regex patterns). These may be indicators of automated/scripted credential access behavior. Monitoring when the user's .bash_history is read can help alert to suspicious activity. While users do typically rely on their history of commands, they often access this history through other utilities like "history" instead of commands like cat ~/.bash_history. Additionally, monitor processes for applications that can be used to query the Registry, such as Reg, and collect command parameters that may indicate credentials are being searched. Correlate activity with related suspicious behavior that may indicate an active intrusion to reduce false positives.

References

Связанные риски

Ничего не найдено

Каталоги

Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.